{"id":"CVE-2026-110992","kind":"vulnerability","aliases":["CVE-2026-110992"],"related":[],"title":"Grafana: Git Sync jobs let editors delete files outside repository path","description":"A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.","summary":"A user who can create Git Sync provisioning jobs, which the Editor role allows by default, can use a resource path containing ../ sequences to delete or move files outside the configured repository. With a local filesystem repository on Grafana versions before 13.0.4 and 13.1.1, this reaches files on the Grafana host.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git-sync","grafana","self-hosted","vendor"],"not_affected_if":["fixed-version","no-git-sync","remote-git-repository"],"how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI.\n- Check whether Git Sync is in use with a local filesystem repository in the provisioning configuration.","fix":"- Grafana versions before `13.0.4` and `13.1.1`: move to `13.0.4` or `13.1.1` or later.","status":"open","published_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:48+00:00","updated_at":"2026-11-11T15:29:48+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-11T15:29:48Z","model":"claude-haiku-5-5","output":{"fix":"- Grafana versions before `13.0.4` and `13.1.1`: move to `13.0.4` or `13.1.1` or later.","reach":"network","title":"Grafana: Git Sync jobs let editors delete files outside repository path","impact":"medium","summary":"A user who can create Git Sync provisioning jobs, which the Editor role allows by default, can use a resource path containing ../ sequences to delete or move files outside the configured repository. With a local filesystem repository on Grafana versions before 13.0.4 and 13.1.1, this reaches files on the Grafana host.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["grafana","self-hosted","git-sync"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"files on the Grafana host deleted or moved outside the repository","analyst_note":"","how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI.\n- Check whether Git Sync is in use with a local filesystem repository in the provisioning configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-git-sync","remote-git-repository"],"who_is_affected":"Grafana instances that use Git Sync with a local filesystem repository are exposed, and only users who can create provisioning jobs can trigger the flaw. Instances on versions 13.0.4 or 13.1.1 and later, or instances that do not use Git Sync with a local filesystem repository, are not affected by the reported impact.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4558,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110992':14A,17A '-2026':13A,16A '13.0.4':67B,123C '13.1.1':69B,125C 'allow':39B 'configur':56B,98C 'contain':47B,111C 'could':91C 'creat':30B,81C 'cve':12A,15A 'default':41B,90C 'delet':7A,50B,92C 'editor':6A,37B,87C 'file':8A,53B,72B,95C,128C 'filesystem':61B,118C 'git':2A,19B,31B,82C 'git-sync':18B 'grafana':1A,21B,64B,75B,131C 'host':24B,76B,132C 'job':4A,34B,85C,103C 'let':5A 'local':60B,117C 'move':52B,94C 'outsid':9A,54B,96C 'path':11A,46B,100C,110C,113C 'provis':33B,84C 'reach':71B,127C 'refer':105C 'repositori':10A,57B,62B,99C,119C 'resourc':45B,107C 'role':38B,88C 'self':23B 'self-host':22B 'sequenc':48B,112C 'sourc':109C 'sync':3A,20B,32B,83C 'travers':114C 'use':43B 'user':27B,78C 'vendor':25B 'version':65B,121C 'whose':108C","nicknames":[],"mitigations":[],"who_affected":"Grafana instances that use Git Sync with a local filesystem repository are exposed, and only users who can create provisioning jobs can trigger the flaw. Instances on versions 13.0.4 or 13.1.1 and later, or instances that do not use Git Sync with a local filesystem repository, are not affected by the reported impact.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gitsync","grafana","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-110992':14A,17A '-2026':13A,16A 'cve':12A,15A 'delet':7A 'editor':6A 'file':8A 'git':2A 'grafana':1A 'job':4A 'let':5A 'outsid':9A 'path':11A 'repositori':10A 'sync':3A","search_b":"'13.0.4':67B '13.1.1':69B 'allow':39B 'configur':56B 'contain':47B 'creat':30B 'default':41B 'delet':50B 'editor':37B 'file':53B,72B 'filesystem':61B 'git':19B,31B 'git-sync':18B 'grafana':21B,64B,75B 'host':24B,76B 'job':34B 'local':60B 'move':52B 'outsid':54B 'path':46B 'provis':33B 'reach':71B 'repositori':57B,62B 'resourc':45B 'role':38B 'self':23B 'self-host':22B 'sequenc':48B 'sync':20B,32B 'use':43B 'user':27B 'vendor':25B 'version':65B","search_c":"'13.0.4':123C '13.1.1':125C 'configur':98C 'contain':111C 'could':91C 'creat':81C 'default':90C 'delet':92C 'editor':87C 'file':95C,128C 'filesystem':118C 'git':82C 'grafana':131C 'host':132C 'job':85C,103C 'local':117C 'move':94C 'outsid':96C 'path':100C,110C,113C 'provis':84C 'reach':127C 'refer':105C 'repositori':99C,119C 'resourc':107C 'role':88C 'sequenc':112C 'sourc':109C 'sync':83C 'travers':114C 'user':78C 'version':121C 'whose':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110992","severity":null,"published_at":"2026-11-11T15:17:14+00:00","modified_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}